Analysis
-
max time kernel
149s -
max time network
154s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
30-11-2024 07:27
Behavioral task
behavioral1
Sample
bot.arm5.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
bot.arm5.elf
-
Size
130KB
-
MD5
35e26c103bfe7271da13ba1b34c8c427
-
SHA1
5e6f5e52565ef44c28e83648edd6baa2e36a894f
-
SHA256
32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822
-
SHA512
08d7545f93c062f965f248aea4e8c2f631a7249c2bd9166f6c52488a8206f822128ea55d6ddae18c0d7b064db37d1ba7568e4987dec70010c54481d4635ee252
-
SSDEEP
1536:zP8g2CSJG5mIOd34M1Ae0Y1jAFrZ4V/3ETVORjbaiMtjpChMDzlkHwywVFN+a41z:z0FGo1ZV1jI45ERORjbCZpCKnXQL
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M " 652 bot.arm5.elf -
description ioc Process File opened for reading /proc/734/cmdline bot.arm5.elf File opened for reading /proc/74/cmdline bot.arm5.elf File opened for reading /proc/139/cmdline bot.arm5.elf File opened for reading /proc/710/cmdline bot.arm5.elf File opened for reading /proc/13/cmdline bot.arm5.elf File opened for reading /proc/677/cmdline bot.arm5.elf File opened for reading /proc/692/cmdline bot.arm5.elf File opened for reading /proc/729/cmdline bot.arm5.elf File opened for reading /proc/763/cmdline bot.arm5.elf File opened for reading /proc/772/cmdline bot.arm5.elf File opened for reading /proc/775/cmdline bot.arm5.elf File opened for reading /proc/779/cmdline bot.arm5.elf File opened for reading /proc/22/cmdline bot.arm5.elf File opened for reading /proc/17/cmdline bot.arm5.elf File opened for reading /proc/147/cmdline bot.arm5.elf File opened for reading /proc/302/cmdline bot.arm5.elf File opened for reading /proc/462/cmdline bot.arm5.elf File opened for reading /proc/656/cmdline bot.arm5.elf File opened for reading /proc/673/cmdline bot.arm5.elf File opened for reading /proc/703/cmdline bot.arm5.elf File opened for reading /proc/14/cmdline bot.arm5.elf File opened for reading /proc/728/cmdline bot.arm5.elf File opened for reading /proc/266/cmdline bot.arm5.elf File opened for reading /proc/655/cmdline bot.arm5.elf File opened for reading /proc/718/cmdline bot.arm5.elf File opened for reading /proc/768/cmdline bot.arm5.elf File opened for reading /proc/9/cmdline bot.arm5.elf File opened for reading /proc/29/cmdline bot.arm5.elf File opened for reading /proc/660/cmdline bot.arm5.elf File opened for reading /proc/671/cmdline bot.arm5.elf File opened for reading /proc/709/cmdline bot.arm5.elf File opened for reading /proc/28/cmdline bot.arm5.elf File opened for reading /proc/24/cmdline bot.arm5.elf File opened for reading /proc/672/cmdline bot.arm5.elf File opened for reading /proc/675/cmdline bot.arm5.elf File opened for reading /proc/676/cmdline bot.arm5.elf File opened for reading /proc/689/cmdline bot.arm5.elf File opened for reading /proc/694/cmdline bot.arm5.elf File opened for reading /proc/699/cmdline bot.arm5.elf File opened for reading /proc/1/cmdline bot.arm5.elf File opened for reading /proc/770/cmdline bot.arm5.elf File opened for reading /proc/774/cmdline bot.arm5.elf File opened for reading /proc/769/cmdline bot.arm5.elf File opened for reading /proc/674/cmdline bot.arm5.elf File opened for reading /proc/740/cmdline bot.arm5.elf File opened for reading /proc/742/cmdline bot.arm5.elf File opened for reading /proc/750/cmdline bot.arm5.elf File opened for reading /proc/756/cmdline bot.arm5.elf File opened for reading /proc/648/cmdline bot.arm5.elf File opened for reading /proc/653/cmdline bot.arm5.elf File opened for reading /proc/680/cmdline bot.arm5.elf File opened for reading /proc/690/cmdline bot.arm5.elf File opened for reading /proc/695/cmdline bot.arm5.elf File opened for reading /proc/715/cmdline bot.arm5.elf File opened for reading /proc/731/cmdline bot.arm5.elf File opened for reading /proc/777/cmdline bot.arm5.elf File opened for reading /proc/43/cmdline bot.arm5.elf File opened for reading /proc/10/cmdline bot.arm5.elf File opened for reading /proc/23/cmdline bot.arm5.elf File opened for reading /proc/681/cmdline bot.arm5.elf File opened for reading /proc/696/cmdline bot.arm5.elf File opened for reading /proc/713/cmdline bot.arm5.elf File opened for reading /proc/732/cmdline bot.arm5.elf File opened for reading /proc/748/cmdline bot.arm5.elf